T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/query_eastmoney.py:9- Finding
Hard-Coded Eastmoney API Credential Exposed in Source Code and Documentation
- Content
View full analysis
": print("❌ 请设置 EASTMONEY_APIKEY 环境变量") return None ``` `SKILL.md:11-13`: ```markdown ## 环境变量 - `EASTMONEY_APIKEY`: 东方财富 API key (默认：`mkt_Z19TUfMY79_44k4wZsAHIVGVva0-g8PxD_DkBDQx2iM`) ``` `SKILL.md:41-44`: ```python def get_eastmoney_news(query): apikey = os.environ.get("EASTMONEY_APIKEY", "mkt_Z19TUfMY79_44k4wZsAHIVGVva0-g8PxD_DkBDQx2iM") ``` ### Technical Analysis A reusable Eastmoney API key is embedded directly in both the executable source code and its documentation. The environment-variable lookup does not protect the credential because the disclosed value is used as a functional fallback whenever `EASTMONEY_APIKEY` is absent. Secrets committed to distributed source files must be treated as compromised. Any person or automated scanner with access to the skill package can recover the key without executing the code. The key can then be supplied directly to the documented Eastmoney endpoint from an unrelated system. The existing absence check is ineffective for this exposure: because the hard-coded fallback is nonempty and does not equal the placeholder string, execution proceeds with the exposed credential. ### Attack Path 1. An attacker downloads or otherwise reads the skill package. 2. The attacker extracts the API key from `scripts/query_eastmoney.py` or `SKILL.md`. 3. The attacker constructs requests to the documented endpoint: `https://mkapi2.dfcfs.com/finskillshub/api/claw/news-search`. 4. The attacker places the extracted ...[truncated 919 chars]- Remediation
View remediation